CVE-2026-53815: OpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-11 · updated 2026-06-17
Weakness: CWE-862

Description

OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploiting insufficient validation in the affected feature, potentially exposing sensitive channel messages.

Affected products

OpenClaw: before 2026.5.19 — fixed in 2026.5.19

How to fix

Upgrade to a fixed version: OpenClaw 2026.5.19. Check the vendor advisory for mitigations.

References

https://github.com/openclaw/openclaw/security/advisories/GHSA-q7q8-3mgw-q67r
https://www.vulncheck.com/advisories/openclaw-channel-allowlist-bypass-in-message-read-actions

Get alerted when CVE-2026-53815 or the next vulnerability affects your stack